Hi , everyone , today i'm going to show how to perform xxe exploitation
for the story , XXE stands for "xml external entity"
it's a kind of vulnerability of web system that takes advantage of a flow of data parsed and dispkayed onto xml related documents

*How XML Works
              xml have basic key concept like

    

    1-entity and referencer in xml

       

    
The example above is what xml looks like , it something where datas are stored following a structure that we called entity , entity contains that tags that give more informations about the subject we face.

    

   1-1 Document Type definition

    

    Like in html concept , the use of document type
    definition in xml is crucial for what we lead to .We
    could think about it as set of rules that engages and
    define the model of an xml file
    Take this example below:

            

    this is another key concept of defining xml object.
  

 2-Exploitation

        

          Now , we'll going to explore how take advantage of
    these situations to handle our goal as pentester .
    
    First of all ,let's talk about how data are stored
    and shared.
    
    So, when both computers agreed on the structure
     they gonna use , they choose the way to share it
     One of the basic key concept is to use an
     "External Entity Reference": that means we index
     some link/file inside of xml entity like a referer
     and then xml when executed will read and load
     the content of parsed data she has.
     
     Example :
            
            
           

            
           

        
    These examples above show how xml is conducted using external referer
    Both of them coming from interesting machine on  Tryhackme i recommand to check out (Advent of Cyber 2024- Day 5)
    
    So the 2nd crafted document is some kind of payload that will load /etc/hosts information of the system the code is executed , which means on some server if you introduce it : below an example using burp repeater

    
    Oh, that's already end ; So that's all for this sequence . I hope this basic understanding of xxe will help you
    understand more concept of Web Application Exploitation
    
    
    You're free to suggest more content to help community grow
    
    Buy me a coffee if you want , it will be cool either
        



contact : dsbsfxtn4@mozmail.com
                        
                        Hope you enjoy it , artemis6x